elunez/eladmin · error · BadRequestException

登录密码错误

Error message

登录密码错误

What it means

AuthController.login loads the user via userDetailsService, decrypts the RSA-encrypted password with the server private key, and runs passwordEncoder.matches (BCrypt). A mismatch throws '登录密码错误'. Note the captcha was already consumed, so the next attempt needs a fresh captcha.

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/security/rest/AuthController.java:97

    @AnonymousPostMapping(value = "/login")
    public ResponseEntity<Object> login(@Validated @RequestBody AuthUserDto authUser, HttpServletRequest request) throws Exception {
        // 密码解密
        String password = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey, authUser.getPassword());
        // 查询验证码
        String code = redisUtils.get(authUser.getUuid(), String.class);
        // 清除验证码
        redisUtils.del(authUser.getUuid());
        if (StringUtils.isBlank(code)) {
            throw new BadRequestException("验证码不存在或已过期");
        }
        if (StringUtils.isBlank(authUser.getCode()) || !authUser.getCode().equalsIgnoreCase(code)) {
            throw new BadRequestException("验证码错误");
        }
        // 获取用户信息
        JwtUserDto jwtUser = userDetailsService.loadUserByUsername(authUser.getUsername());
        // 验证用户密码
        if (!passwordEncoder.matches(password, jwtUser.getPassword())) {
            throw new BadRequestException("登录密码错误");
        }
        Authentication authentication = new UsernamePasswordAuthenticationToken(jwtUser, null, jwtUser.getAuthorities());
        SecurityContextHolder.getContext().setAuthentication(authentication);
        // 生成令牌
        String token = tokenProvider.createToken(jwtUser);
        // 返回 token 与 用户信息
        Map<String, Object> authInfo = new HashMap<String, Object>(2) {{
            put("token", properties.getTokenStartWith() + token);
            put("user", jwtUser);
        }};
        if (loginProperties.isSingleLogin()) {
            // 踢掉之前已经登录的token
            onlineUserService.kickOutForUsername(authUser.getUsername());
        }
        // 保存在线信息
        onlineUserService.save(jwtUser, token, request);
        // 返回登录信息
        return ResponseEntity.ok(authInfo);

View on GitHub (pinned to 55fbf70595)

Solutions

  1. Verify the password is correct (test with the default admin/123456 on a fresh install).
  2. Confirm the frontend RSA public key matches the backend RsaProperties private key pair — mismatch silently corrupts the decrypted plaintext.
  3. If hashes are suspect, reset the password (e.g. update user.password to a fresh BCrypt hash of a known value) and retry.
  4. Check for duplicate username rows that could load the wrong account.

Example fix

-- before: unknown/corrupt hash
SELECT username, password FROM users WHERE username='admin'; -- not $2a$...
-- after: reset with a known BCrypt hash of 123456
UPDATE users SET password='$2a$10$/o9l7bZvGzQFG6rQeV5VNeqOxRrXTZJJvNbNbVrvwXw8Vz8yOa1Ue' WHERE username='admin';
Defensive patterns

Strategy: try-catch

Validate before calling

// client: verify the RSA public key matches the deployed backend pair before login
if (publicKeyFingerprint !== expectedFingerprint) { throw new Error('RSA公钥与后端不匹配，请更新前端配置'); }
const encrypted = encrypt(password);
await api.post('/auth/login', { username, password: encrypted, code, uuid });

Try / catch

try { await login(payload); } catch (e) { if (e.message.includes('登录密码错误')) { await refreshCaptcha(); lockAfter(5, () => toast('密码错误，请重试或重置')); return; } throw e; }

Prevention

When it happens

Trigger: POST /auth/login with a correct username/captcha but wrong password; also produced when the RSA public key used by the frontend does not correspond to the server's private key (decrypt yields garbage that never matches), or when the stored password hash is not a BCrypt encoding of the expected plaintext.

Common situations: Genuine typo by the user; password reset in another environment; frontend rsaKey out of sync after regenerating/rotating the server RSA keypair; migrated user records with plain or differently-hashed passwords; duplicate usernames resolving to the wrong account.

Related errors

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/f6a52bedccbcb3e0. Report an issue: GitHub.